Issue: Sophos Central Admin – US-West region - Delays with the enforcement of Central policies on managed endpoints.

Hey fellow Sophos Central users.

This thread has grown quite long, and for the last several months there has been very little real insight or action from Sophos.

Make your voices heard outside of this thread.  There are several IT software review platforms that can be used to share your experiences.

Gartner Peer Insights - https://www.gartner.com/reviews/market/Cloud-Workload-Protection-Platforms/vendor/sophos?pid=12411

G2Crowd - https://www.g2crowd.com/products/sophos-endpoint-security/reviews

TrustRadius - https://www.trustradius.com/products/sophos-endpoint-protection/reviews

Thanks for this. I will definitely be making my voice heard at Gartner.

Sophos shouldn't be listed anywhere on the Quadrant at this time with the state of its Cloud software in such disarray. 

Does Sophos have a "TOOL" to remove their agents from workstations/.

Oh why in the world would they make that easy either??????? You have to do the tamper protection key and then uninstall manually as far as I know.

I know the feeling during our purchase we had some issues with the pricing vs quote and I could not talk with the sales manager,

He was in the Bahamas or some place like that because they had "hit there numbers" would hope they would have put that $$$ to building a better product.

Trevor Karppi said:

Oh why in the world would they make that easy either??????? You have to do the tamper protection key and then uninstall manually as far as I know.

 

I would be even better if Tamper Protection actually worked when you told it to STOP PROTECTING so you can uninstall the software.

Did that, tried that. Sophos keeps complaining the the Tamper Protection...the one I just turned off by selecting PC from Dashboard and turning off TP, ......is still running. So when I go to try and uninstall this so called agent, Unable to Uninstall, Tamper Protection must be turned off.....

Then you just get to go around in circles.

This software in a nut shell DOES NOT WORK.

This is all I can give you to get tamper protection off of a machine that is corrupted. It's the biggest pain in the butt but it does work. I speak from personal experience as I've had to do this on 20 machines in our company already... Please give your comments in the forum on this process :)

Do this:

Sophos Central managed client:

To recover a tamper protected system, you must disable Enhanced Tamper Protection.
Do the following:

1. Boot the system into Safe Mode.
2. Click Start > Run > services.msc > right-click Sophos Anti-Virus service > properties > set to disabled > OK
3. Click Start > Run and type regedit and then click OK.
4. Go to the following location in the registry editor:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos MCS Agent and set the REG_DWORD Start to 0x00000004
5. Go to the following location in the registry editor:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos Endpoint Defense\TamperProtection\Config and set the following REG_DWORD values SAVEnabled and SEDEnabled to 0
6. Go to the following location in the registry editor:
   HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Sophos\SAVService\TamperProtection and set the REG_DWORD Enabled to 0
7. Reboot the system in normal mode.

Enhanced Tamper Protection is now disabled.
You should now be able to access the system.

https://community.sophos.com/kb/en-us/124377

I can speak from personal experience that this process often does not work.  I tried opening a support case when it didn't, but I found I got a better response from a brick wall.  In the end, I found we need to re-image the machines where tamper protection is broken.

Wow what happened? Not one of mine failed, were you logged into the machine with the local admin account in safe mode?

I was logged in as local admin.  Perhaps it is something with x86 vs x64 as the keys reference the WOW6432Node but it doesn't have separate steps for each type of architecture.  I found Sophos often doesn't know how their own product works so this is nothing new.

My personal favorite was when clamav.exe was using high CPU and support told me to uninstall it as it causes problems with Sophos.  A simple check told me that clamav.exe was called by Sophos and was part of their product (don't know if it still is, but at the time it was).  In other words they told me to uninstall Sophos to fix the computer.

Ohhhh damn.

This just get Uglier and uglier. User is a road warrior who I may not see for weeks on end.

Remote desktop into Safe Mode...not sure if that can even be done.

Let the user take control.....not likely.

I feel your pain my friend! Thankfully we use Bomgar so we can remote reboot a computer into safemode with networking. I'll let you know if I can think of a different way to do this.

I feel your pain my friend! Thankfully we use Bomgar so we can remote reboot a computer into safemode with networking. I'll let you know if I can think of a different way to do this.